Release record

iOS 4.3.2

Full article

Public release

Recorded milestones: 1
Beta cycle: —
Average interval: —
Public release: Apr 14, 2011

Release notes

Overview

Editorial synthesis with inline references and a source ledger when citations are available.

The trust-policy change rejected a set of fraudulently issued SSL certificates that could otherwise support interception of credentials or other sensitive information by an attacker in a privileged network position.^[1]

The update also stopped an XPath function from exposing heap addresses, corrected a QuickLook memory-corruption issue in Microsoft Office file handling, and fixed two WebKit flaws involving node sets and text-node lifetime. Apple’s index dates the package to April 14, 2011.^[2]^[3]

Source ledger

References

Sources are linked to the claims they support. Publication and access dates are shown when available.

About the security content of iOS 4.3.2 Software Update
Apple Support · 2026-07-30 · Certificate Trust Policy
Back to text ↑
Apple security updates (2011 to 2012)
Apple Support · Apple · 2023-08-10T00:00:00.000Z · iOS 4.3.2 — 14 Apr 2011
Back to text ↑
About the security content of iOS 4.3.2 Software Update
Apple Support · 2026-07-30 · libxslt, QuickLook, and WebKit entries
Back to text ↑
About the security content of iOS 4.3.2 Software Update
Apple Support · 2026-07-30 · iOS 4.3.2 security content

Documented & observed

Changes in this version

Source-linked features, fixes, known issues, removals, and community-observed behavior recorded across this version’s appearances and verified builds.

Release changes

Changed in this release

Features, fixes, removals, and regressions first observed in this release record.

security · fixed

QuickLook Office-file memory safety

documentedconfirmed

Apple documented unexpected application termination or arbitrary code execution as possible outcomes.

Recorded at Public

[1] About the security content of iOS 4.3.2 Software Update · QuickLook — CVE-2011-1417

security · fixed

WebKit text-node lifetime

documentedconfirmed

Apple documented browser termination or arbitrary code execution after visiting a crafted website.

Recorded at Public

[1] About the security content of iOS 4.3.2 Software Update · WebKit — CVE-2011-1344

security · fixed

WebKit nodeset integer overflow

documentedconfirmed

A malicious page could use the defect to terminate an application or execute code.

Recorded at Public

[1] About the security content of iOS 4.3.2 Software Update · WebKit — CVE-2011-1290

security · fixed

libxslt heap-address disclosure

documentedconfirmed

The old behavior could disclose heap addresses to a malicious page and help bypass address-space randomization.

Recorded at Public

[1] About the security content of iOS 4.3.2 Software Update · libxslt — CVE-2011-0195

security · fixed

Fraudulent certificate blocklist

documentedconfirmed

This reduced the ability of a privileged network attacker to redirect connections and intercept credentials or other sensitive data using those certificates.

Recorded at Public

[1] About the security content of iOS 4.3.2 Software Update · Certificate Trust Policy

Milestones

Release history

Every recorded channel appearance in chronological order. Open an appearance for any available build, scope, notes, and sources.

Apr 14, 2011
Public release
Public
Full articleEditorially verified
iOS 4.3.2 blacklisted fraudulently issued certificates and repaired address disclosure, QuickLook document parsing, and WebKit memory-safety defects.
Availability
available
Sources
8 linked
Open this appearance

Historical context

Cycle comparison

Pace, intervals, and duration compared with earlier releases on the same platform.

Historical avg for .3.2 releases

40 days, 3.0 milestones

Based on 1 previous iOS .3.2 releases

Previous .3.2 releases (iOS)

Previous comparable iOS releases
Version	Year	Cycle	Milestones	Avg. Interval
iOS 9.3.2	2016	40d	3	20d

Scroll horizontally to compare every historical field.

Official release notes